We have a firewall out of our firm network and administrators connect to this firewall by VPN over TLS. Scanning this firewall, the vulnerability scanner get us some warning as the 443 port allow weak ciphers & hash functions like RC4, MD5, SHA1, 3DES ...

So we asked firewall manufacturer how to fix it and they responded that's not possible to remove cipher suite, but as we don't use those ciphers (client side) it's not a vulnerability.

It seems like an easy response to get rid of us. So what is the risk to allow weak ciphers if we use/enforce strong cipher on the client side ?

  • 2
    Please see this and this. What if there is a downgrade attack, somewhere?
    – kelalaka
    Commented Feb 14, 2019 at 16:30
  • 1
    Basically what @kelalaka said. Downgrade to something like RC4 shouldn't be possible if your client only supports secure ciphers, but the RSA attack relies on a side channel in the server implementation to perform operations with the private key, which breaks all ciphers using RSA, not just weak ciphers. There is nothing the client can do to prevent it. Commented Feb 14, 2019 at 16:54


You must log in to answer this question.

Browse other questions tagged .